SCS-C02 Threat Detection and Incident Response Practice Test 15 — 15 Questions

Question 1

A company uses AWS CloudTrail to log all API activity. The security team wants to ensure that any changes to CloudTrail configuration (e.g., disabling the trail, deleting the trail, modifying the log delivery) are detected immediately. They have created a CloudWatch Events rule to capture the event 'StopLogging' and send an SNS notification. During testing, the team stops the trail and does not receive the notification. The CloudWatch Events rule is configured with the correct event pattern. What should the team check?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

Check the IAM role associated with the CloudWatch Events rule to ensure it has permissions to publish to the SNS topic.. CloudWatch Events rules require an IAM role with permissions to invoke the target (e.g., publish to SNS). Even if the event pattern matches and the SNS topic exists, without a properly configured IAM role that grants `sns:Publish` to the CloudWatch Events service, the rule cannot deliver the notification. This is a common misconfiguration that causes silent failures.

Answer

Verify that the CloudTrail trail is logging management events.

Answer

Ensure that the event pattern includes the correct source and detail-type.

Answer

Confirm that the SNS topic subscription is confirmed.

Question 2

A company uses Amazon GuardDuty and AWS Security Hub. The security team has configured a custom insight in Security Hub to track findings related to S3 bucket exposures. They want to automatically remediate these findings by applying an S3 bucket policy that blocks public access. The team has created a Lambda function that applies the bucket policy and configured Security Hub to send findings to the Lambda function via a custom action. However, when a new finding is generated, the Lambda function is invoked but fails to apply the policy because it does not have permission to modify the S3 bucket. The Lambda function's execution role has permissions to modify S3 bucket policies, but the function is in the same account as the bucket. What should the team check?

Accepted Answer

Check the S3 bucket policy for any explicit deny statements that might block the Lambda function's role.. Even if the Lambda function has permissions, the S3 bucket policy may explicitly deny access to the Lambda function's role. Option A is incorrect because bucket ACLs are not used to grant permissions to Lambda functions; the Lambda function's execution role needs to be allowed by the bucket policy. Option B is incorrect because Security Hub does not need to assume the Lambda execution role; Security Hub sends events to Lambda via a custom action, and Lambda is invoked directly—no trust policy for Security Hub is required. Option D is incorrect because S3 block public access settings control whether bucket policies that grant public access can be applied, but they do not prevent the Lambda function from modifying the bucket policy; the issue is likely an explicit deny in the bucket policy.

Answer

Add the Lambda function's execution role to the bucket's Access Control List (ACL).

Answer

Ensure that the Lambda function's execution role has a trust policy that allows Security Hub to assume it.

Answer

Verify that the S3 bucket's block public access settings are not preventing the policy update.

Question 3

A company runs a critical web application on Amazon EC2 instances behind an Application Load Balancer (ALB). The application processes sensitive customer data. The Security team has enabled VPC Flow Logs, CloudTrail, and GuardDuty. Recently, the team received a GuardDuty finding indicating a potential SSH brute force attack originating from an external IP address 203.0.113.50 targeting one of the EC2 instances. The Security Engineer needs to automatically isolate the affected instance and capture forensic evidence for analysis. The company has strict requirements: the instance must be isolated immediately, and a snapshot of the EBS volume must be taken before any remediation actions are taken. The instance is part of an Auto Scaling group, and the Security Engineer wants to minimize manual intervention. The Security Engineer has access to AWS Systems Manager and AWS Lambda. Which combination of steps should the Security Engineer implement to meet the requirements?

Accepted Answer

Configure Amazon EventBridge to detect the GuardDuty finding and invoke an AWS Lambda function. The Lambda function first calls the EC2 CreateSnapshot API to capture a forensic snapshot of the instance's EBS volume. Then, it uses AWS Systems Manager Automation to run a pre-defined automation document that isolates the instance by modifying the instance's security group to only allow traffic from a trusted management IP, and then stops the instance.. It uses EventBridge to directly detect the GuardDuty finding, which triggers a Lambda function that first takes an EBS snapshot (forensic capture) via the CreateSnapshot API before any remediation. Then it uses Systems Manager Automation to isolate the instance by modifying the security group to allow only a trusted management IP and stops the instance, ensuring isolation without destroying the instance. This sequence satisfies the strict requirement that a snapshot must be taken before any remediation actions, and it minimizes manual intervention by automating the entire response.

Answer

Use AWS Systems Manager to automatically connect to the instance via EC2 Instance Connect, run commands to capture forensic data, and then modify the security group to deny all inbound traffic.

Answer

Create a CloudWatch Logs metric filter on the VPC Flow Logs for the attacker IP. When the metric breaches a threshold, trigger an SNS topic that runs an AWS Systems Manager Automation document to isolate the instance and take an EBS snapshot.

Answer

Configure a CloudWatch Events rule to detect the GuardDuty finding and invoke an AWS Lambda function. The Lambda function terminates the EC2 instance and then takes a snapshot of the EBS volume for forensic analysis.

Question 4

A security engineer is investigating a potential data exfiltration incident. The engineer notices large volumes of data being transferred from an Amazon S3 bucket to an external IP address. Which AWS services can be used to detect and alert on such behavior? (Choose THREE.)

Accepted Answer

Amazon CloudWatch Logs with S3 access log analysis.. Amazon CloudWatch Logs can ingest and analyze S3 access logs, which record detailed information about requests made to an S3 bucket, including the source IP address, request type, and bytes transferred. By analyzing these logs with CloudWatch Logs Insights or metric filters, you can detect large data transfers to external IPs and trigger alerts via CloudWatch Alarms, making it a valid detection and alerting mechanism for data exfiltration.

Answer

AWS Config with compliance rules.

Answer

VPC Flow Logs.

Question 5

Drag and drop the steps to implement a secure CI/CD pipeline with AWS CodePipeline and IAM in the correct order.

Accepted Answer

First, create IAM roles with least privilege for CodePipeline and CodeBuild. Then, create an encrypted S3 bucket for storing artifacts. Next, create a source repository (e.g., AWS CodeCommit). After that, create a build project configured with security scanning tools. Finally, create the CodePipeline that integrates the source, build, and deployment stages.. Secure pipeline requires encrypted artifact bucket, IAM roles, source repo, build project with security scanning, and pipeline.

Answer

First, create an encrypted S3 bucket. Then, create a source repository. Next, create IAM roles. After that, create a build project with security scanning. Finally, create the pipeline.

Answer

First, create the pipeline. Then, create a source repository. Next, create a build project with security scanning. After that, create IAM roles. Finally, create an encrypted S3 bucket.

Answer

First, create a source repository. Then, create a build project with security scanning. Next, create IAM roles. After that, create the pipeline. Finally, create an encrypted S3 bucket.

Question 6

Match each AWS service to its primary security function.

Accepted Answer

AWS WAF: Web application firewall that protects against common web exploits.. These are core AWS security services with distinct purposes.

Answer

AWS WAF: Managed DDoS protection service.

Answer

AWS Shield: Threat detection service.

Question 7

Match each AWS IAM policy type to its description.

Accepted Answer

Identity-based policy: Attached to an IAM user, group, or role to define permissions. The correct matches are: Identity-based policies are attached to users, groups, or roles; Resource-based policies are attached to resources; Permissions boundaries limit maximum permissions; Session policies are passed during role assumption. Common confusions include swapping identity-based and resource-based definitions.

Answer

Identity-based policy: Attached to a resource and defines which principals can access it

Answer

Resource-based policy: Attached to an IAM user, group, or role

Question 8

A security engineer notices that an IAM role used by an EC2 instance is generating a large number of API calls to an S3 bucket that is not part of the company's account. Which AWS service should be used to detect and alert on this suspicious activity?

Accepted Answer

Amazon GuardDuty. Amazon GuardDuty is the correct service because it uses machine learning and anomaly detection to analyze AWS CloudTrail management and data events, VPC Flow Logs, and DNS logs. It can detect unusual API calls, such as an EC2 instance role making a high volume of requests to an S3 bucket outside the company's account, which is a classic indicator of compromised credentials or data exfiltration. GuardDuty generates findings and can integrate with Amazon CloudWatch Events to trigger alerts or automated remediation.

Answer

AWS CloudTrail

Answer

Amazon Inspector

Answer

AWS Config

Question 9

A company uses AWS Organizations with multiple accounts. The security team wants to centrally collect and analyze CloudTrail logs from all accounts in a single S3 bucket. What is the most efficient way to achieve this?

Accepted Answer

Create a single organization trail in the management account that logs all accounts.. AWS Organizations supports creating a single organization trail in the management account that automatically logs CloudTrail events for all accounts in the organization. This centralizes log collection into one S3 bucket without needing to configure trails per account, making it the most efficient and scalable approach for multi-account environments.

Answer

Create a CloudTrail trail in each account and configure the same S3 bucket as the destination.

Answer

Use CloudWatch Logs subscription filter to send logs from each account to a central account.

Answer

Use S3 cross-region replication to copy logs from each account's bucket to a central bucket.

Question 10

A company uses Amazon GuardDuty and receives a finding of type 'Backdoor:EC2/C&CActivity.B!DNS' for an EC2 instance. What does this finding indicate?

Accepted Answer

The instance is communicating with a known command and control server.. The finding 'Backdoor:EC2/C&CActivity.B!DNS' indicates that GuardDuty has detected DNS queries from the EC2 instance to a domain associated with known command and control (C&C) infrastructure. This is based on GuardDuty's threat intelligence feeds that map DNS request patterns to known malicious domains, signaling that the instance may be compromised and communicating with an attacker's server.

Answer

The instance is being targeted by an SSH brute force attack.

Answer

The instance is exfiltrating data to an S3 bucket.

Answer

The instance is being used in a DDoS attack.

Question 11

Which THREE actions should be taken when preserving forensic evidence from an EC2 instance during an incident? (Select THREE.)

Accepted Answer

Create an EBS snapshot of all volumes.. Creating an EBS snapshot preserves the exact state of the volume at the time of the incident, including any malicious files, logs, or artifacts. This snapshot can be used for offline forensic analysis without altering the original evidence. AWS recommends this as a first step in forensic acquisition to maintain chain of custody.

Answer

Reboot the instance to clear any malicious processes.

Answer

Terminate the instance to prevent further compromise.

Question 12

A company uses AWS Organizations with multiple accounts. The security team wants a centralized view of all security alerts and findings from services like GuardDuty, Security Hub, and Inspector across all accounts. What is the MOST efficient way to achieve this?

Accepted Answer

Use AWS Security Hub with cross-account aggregation in the management account.. AWS Security Hub is designed to aggregate findings from multiple security services (GuardDuty, Inspector, etc.) across accounts. By enabling cross-account aggregation in the management account of AWS Organizations, Security Hub provides a single, centralized dashboard for all security alerts and findings without needing to collect raw logs or build custom dashboards. This is the most efficient and native approach for a multi-account environment.

Answer

Use AWS Systems Manager OpsCenter to centrally view all security findings.

Answer

Use individual service consoles (GuardDuty, Security Hub, Inspector) for each account.

Answer

Use Amazon CloudWatch Logs to collect logs from each account and create custom dashboards.

Question 13

A security engineer is configuring automated incident response for an Amazon EC2 instance that has been compromised. The engineer needs to isolate the instance while preserving forensic data. Which solution meets these requirements?

Accepted Answer

Create an AMI of the instance, then remove the instance from the security group to isolate it.. Creating an AMI preserves the EBS volumes and their forensic data, while removing the instance from the security group effectively isolates it by denying all network traffic. This approach allows the engineer to later launch a forensic instance from the AMI in a controlled environment for analysis, without losing the compromised instance's state.

Answer

Detach the EBS volumes and attach them to a new instance in a different VPC.

Answer

Terminate the instance immediately to prevent further damage.

Answer

Stop the instance and change the security group to deny all traffic.

Question 14

A company has enabled AWS CloudTrail and wants to receive real-time notifications when specific API calls, such as DeleteTrail, are made. Which service should be used to trigger an alert based on CloudTrail log events?

Accepted Answer

Amazon CloudWatch Events / Amazon EventBridge. Amazon CloudWatch Events (now part of Amazon EventBridge) is the correct service to trigger real-time alerts based on CloudTrail log events. You can create a rule that matches specific API calls, such as DeleteTrail, and route the event to a target like an SNS topic or Lambda function for immediate notification. CloudTrail delivers log events to CloudWatch Logs, and EventBridge can directly consume those events for pattern matching and alerting.

Answer

AWS CloudTrail console notifications

Answer

Amazon VPC Flow Logs

Answer

Amazon S3 event notifications

Question 15

A company wants to ensure that all API calls made to AWS are logged for security analysis. Which TWO services can be used to achieve this? (Choose two.)

Accepted Answer

Amazon S3 server access logs. Amazon S3 server access logs capture detailed records of requests made to an S3 bucket, including the requester, bucket name, request time, and action. This enables security analysis of API calls specifically targeting S3 resources. AWS CloudTrail records all API calls made to the AWS Management Console, SDKs, and CLI across the entire AWS account, providing a comprehensive audit trail for security analysis.

Answer

Amazon VPC Flow Logs

Answer

Amazon CloudWatch Logs

Answer

AWS Config